From 3aeb2179078d0002ae26a83610b82478f2772213 Mon Sep 17 00:00:00 2001
From: Kenneth Obsequio <k80308392@gmail.com>
Date: Mon, 22 Jun 2026 11:00:00 +0800
Subject: [PATCH] fix: local regression

replace my hard coded thinking

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>
---
 services/s3.service.js | 37 ++++++++++++++++++++++++++-----------
 1 file changed, 26 insertions(+), 11 deletions(-)

diff --git a/services/s3.service.js b/services/s3.service.js
index 94a6f25..d3ad2c4 100644
--- a/services/s3.service.js
+++ b/services/s3.service.js
@@ -18,16 +18,30 @@ const { getSignedUrl } = require("@aws-sdk/s3-request-presigner");
 const crypto = require("crypto");
 const path = require("path");
 
-// ─── Client ───────────────────────────────────────────────────────────────────
+// ─── Clients ──────────────────────────────────────────────────────────────────
 
+const credentials = {
+  accessKeyId:     process.env.S3_ACCESS_KEY,
+  secretAccessKey: process.env.S3_SECRET_KEY,
+};
+
+// Internal client — uploads, deletes, direct streams from the server itself.
 const s3 = new S3Client({
-  endpoint:    process.env.S3_ENDPOINT,
-  region:      process.env.S3_REGION || "garage",
-  credentials: {
-    accessKeyId:     process.env.S3_ACCESS_KEY,
-    secretAccessKey: process.env.S3_SECRET_KEY,
-  },
-  forcePathStyle: true, // required — Garage does not support DNS-style bucket addressing
+  endpoint:       process.env.S3_ENDPOINT,
+  region:         process.env.S3_REGION || "garage",
+  credentials,
+  forcePathStyle: true,
+});
+
+// Public client — generates pre-signed URLs using the externally reachable
+// endpoint (S3_PUBLIC_URL) so URLs work from any machine, not just the one
+// running Garage.  Falls back to the internal endpoint when S3_PUBLIC_URL is
+// unset (single-machine dev).
+const s3Public = new S3Client({
+  endpoint:       process.env.S3_PUBLIC_URL ?? process.env.S3_ENDPOINT,
+  region:         process.env.S3_REGION || "garage",
+  credentials,
+  forcePathStyle: true,
 });
 
 const DEFAULT_BUCKET = process.env.S3_BUCKET    || "philproperties";
@@ -116,12 +130,13 @@ async function deleteFile(key) {
 
 // ─── getSignedDownloadUrl ─────────────────────────────────────────────────────
 //
-// Generates a short-lived pre-signed GET URL.
-// Useful if you ever need gated access to private assets (is_public = false).
+// Generates a short-lived pre-signed GET URL using the public endpoint so the
+// URL is resolvable from any machine (browser or proxy server), not just the
+// one running Garage locally.
 //
 async function getSignedDownloadUrl(key, expiresInSeconds = 3600) {
   return getSignedUrl(
-    s3,
+    s3Public,
     new GetObjectCommand({ Bucket: DEFAULT_BUCKET, Key: key }),
     { expiresIn: expiresInSeconds }
   );